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contained on HD2. The copied "rozza.tar" on HD2 also matched the 
original "rozza.tar" MD5 hash value. i 


On August 4, 2011, sA[ — |submitted HD3 into sgrA b6 


evidence. bic 


"Checksum.txt," which contains the original MD5 hash 
value, and a print screen of the MD5 hash verification conducted on 
"rozza.tar" located on HD3 have been printed and been enclosed ina 
FD-340 envelope for inclusion into the 1A section of the 
substantive case file. 
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On Decemper 16, 


2010, ch warrant was executed at 


server belonging’ to Frantech Solution 


The ined files for a virtual server assigned 
to IP address A logical copy of the virtual server 
files were obtained durifg the search. The logical copy was placed 


on a Nexstar 3 external hard drive (designated as HD1), no visible 
serial number, by CART agents, T TF |] 
Contents of HDI consisted of 2 files; "Rogza.tar," and 
"checksum.txt." "Rozza.tar" is a merger of many files, into one 
file, that contain the actual files of the virtual server, and 


"checksum. txt" contains the MD5 hash value for the "rozza.tar" 


file. SA assumed custody of HD1 at the search site 
for transport to San Jose Resident Agency (SJRA). 

Upon arrival at SJRA, SA connected HD1, via USB, 
to a Dell T7400 desktop computer, SN: (designated as CPU1) 


and created a folder named "Rozza" on the desktop. Using the 
Windows copy/paste function sq sd copied the contents of HD1 
into the folder named "Rozza," and upon completion of the 
copy/paste, disconnected HD1 from CPUL. SA then connected 
an iomega external HD (designated as HD2), SN: to CPU1, 
via USB, and using the Windows copy/paste function copied the 


contents of the "Rozza" folder onto HD2. The purpose of HD2 was to 
serve as a working copy for examination. HD2 was disconnected from 


CPUL and given to SA 


On August 3, 2011, sa[ __]connectea a previously 
forensically wiped 80 GB Western Digital HD (designated as HD3), 
gx: [ Lo cro, via a Tableau T14 IDE pass-through 
device, SN: and using the Windows copy/paste function, 


copied the_contents of the "Rozza" folder, located on CPU1 onto 
HD3. sats Jms hashed the "rozza.tar" file located on HD3 to 
verify that the copied file was identical to the original 
"rozza.tar", located on CPU1. The MD5 hash for the i 
"rozza.tar," matched.the original MD5 hash value, sat] 
disconnected HD3 from CPU1. 


SA connected HD2, via USB, to an Apple 
MacBookPro5,3, SN: and MD5 hashed the "rozza.tar" file 


Investigation on 12/16/2010 at Campbell, CA 
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